Introduction. #
So i went to Action store again after school and manage to buy a lamp. This one seemed new as i never seen it before so i took it. This one is not specially branded LSC, but i can find in the down right corner a small label that says “works with LSC smart connect” so that must mean its a smart light right? It says its compatible with the TV sync box action also sells, but i dont have that yet and i think it can also work without it.
The product itself. #
So here is a link to the product if you are curious (not sponsored).
Box. #
Front of the box
back of box
Side 1 of box
Side 2 of box
Unboxing. #
Setup and testing. #
So it is genuinely wise not to connect random IOT gear to the internet, so i will connect it to my IOT network for only a short period, just for testing. Because its just Tuya under the hood its compatible with All tuya apps and basically a lot of these smart apps by different brands are just rebranded tuya app or smartlife app with a different theme.
And it works!
Teardown. #
Anyways, enough messing around i want to take a look at the insides! Also i want it to stop sending more data to a foreign country so i pulled it from power and started to see how i could open it up. There are no visible screws but there is the horrible diffuser which i think can come off and give us a good starting point. I think its clipped as screws are expensive and they wanted to cut all costs possible.
PCB. #
PCB Back. #
Undoing the 4 screws makes it so we can take out the PCB. and what do we find on the back? Our trusty friend the Tuya T1-H-UL module we found before. No surprises at all! That means they must have really moved to the newer beken chips as this module is again powered by a beken BK7238. I wont go into full detail but you can find more info about it (if this is new to you) Here.
PCB Front. #
So flipping the PCB to the side we where originally looking at and zooming in, we can see the 3 8 pin chips are WS2811 chips. These are the adressable LED driver chips that are sometimes integrated onto the strip itself or even embedded directly into the LED package itself. These are addressable meaning you can send a command to them and can also send multiple commands to multiple different chips. The WS28xx series is very popular and one of the most common types of ledstrips/driver chips you will find. These basically turn the dumb analog LED sections into smart digital addressable sections, so that means the MCU can send a command to section 1 to turn on all LED’s there and then the other 2 sections will keep their state.
Hacking it. #
So next up i wanted to see if i could free it from the cloud and install Opensource firmware on it. Like in my previous projects messing with LSC and tuya products and also just a fact about me: I like privacy and security. IOT often lacks enough of both. And while China is not the only one, i dont want my data ending up in places i dont approve off and with these cheap smart products, there is bound to be cut corners also in terms of security. I dont want my data going to Israel, America or China. Even though it is already happening, my motto “close all doors you can and are willing to close” matters. I cant give up all stuff run by greedy corporations. But you can try and limit it by selfhosting or removing rhe vendor’s stock (spy)firmware. SO thats what i will do!
UART. #
So just like in previous articles i will do it via UART. This time i can solder a header to those empty holes and easily be able to interface with the WIFI module. Then i hooked up my USB to UART and launched openbeken flasher software.
Dumping firmware. #
So i selected the right serial port, selected chip type to be bk7238 and then clicked the button: Firmware backup (read) only to dump the firmware. Then i pulled the Reset line to GND and it started reading the flash chip of th module and the full storage. After its dumped it, it also most of the times instantly reads the Tuya config which becomes handy for identifying and defining I/O pins and other parameters that are mapped and where configured by the vendor. This way you dont need to reverse engineer the whole board.
{
"Jsonver":"1.1.4",
"gmwb":"75",
"title20":"0",
"totallen":"18",
"gmwg":"70",
"knum":"1",
"wfcfg":"spcl_auto",
"colormin":"10",
"pmemory":"1",
"gmkb":"60",
"pairt":"18",
"cmod":"rgb",
"slidemod":"0",
"rstbr":"50",
"ktime":"3",
"control_priority":"1",
"colormax":"100",
"notdisturb":"0",
"module":"T1-U-HL",
"rstmode":"2",
"sfunc":"1",
"key_lv":"0",
"wfct":"3",
"defbright":"100",
"beaconrc":"0",
"rstcor":"r",
"rstnum":"3",
"miso":"17",
"mosi":"16",
"k1dfunc":"0",
"irfunc":"0",
"keyfunc":"1",
"brifollow":"0",
"ismusic":"0",
"prodagain":"1",
"key_pin":"6",
"brightstep":"20",
"remdmode":"0",
"colorpfun":"0",
"CS":"15",
"gmwr":"100",
"rgbt":"20",
"gmkg":"60",
"onoffmode":"0",
"colororder":"0",
"LedNum":"18",
"aging":"1",
"category":"0503",
"SCL":"14",
"gmkr":"80",
"defcolor":"r",
"crc":"117"
}here is the setup
I repeated the process so i got 2 firmware dumps so i always have a backup and its always wise to make atleast 2 copies.
Flashing OpenBEKEN. #
Now the flashing process is exactly the same, except we now hit the “write” button. Reset the chip and after some waiting OpenBEKEN firmware should be installed on the device. Now you can disconnect it from the programmer and plug in the USB power and wait for it to boot up and it should activate a setup wifi network for accessing the setup portal for connecting it to wifi. Something like: OpenBK{chip_number}_{random_string}. Connect to this network with like your phone or such and it should open the configuration portal. Then hit the big blue button saying “Config”, go to “Configure Wifi & Web” and you should be able to put in your wifi credentials. After that it will reboot again and it should get an IP address. You can find that in your router’s list. Or you can use the “LAN scanner” utility openbeken flasher comes with. You can also set a static ip in openbeken directly if you want it to have a predictable always static IP. I did have some issues with my previously flashed obk lights which had the same mac address. This is because it seems like my tool also erases the rf partition so it defaults to a factory macaddress of: c8:47:8c:42:88:48. I also had to click “write Rf part” to write a random Macaddress to the device so it could work.
Configuring OpenBEKEN. #
So next up to configure it. Go to the IP of the device and you should see the default OpenBEKEN page. Then i clicked the “launch Web Application” button, navigated to “Import” and then i copied the Tuya config into the empty box and then i clicked “Clear OBK and apply new script from above” and rebooted the module. This set pin6 as a button pin. Next i went to “Config” and set under “Pin Settings” pin16 as SM16703P_DIN. Pin16 was MOSI in the tuyaconfig meaning “Master Out Slave In”, aka the data output from the main MCU (master) going into the target device (slave). This is just an analogy and it was not chosen by me but its how its called. I also set pin6 to a input as i forgot to mention that the board has a ttp223 touch IC that simply outputs a signal and that feeds into pin 6. I set that as Btn and i could turn on the lamp and turn it off by the touch of the back sun symbol. I did initially try and mess with multiple modes of that button and adding event handlers for specific functions like double tap to increase brightness and hold to decrease brightness but i ended up spending way to much time trying to fix it and it was very unreliable so i decided to ditch that complete and just have that button as a on/off button. Maybe someone else can add it but that is not a requrement for me as i will most of the time control it from Homeassitant anyways. I will post the template below and on elektroda.
{
"vendor": "Tuya",
"bDetailed": "0",
"name": "Action_smart_wall_washer_light",
"model": "3225769",
"chip": "BK7238",
"board": "T1-U-HL",
"flags": "0",
"keywords": [
"TODO",
"TODO",
"TODO"
],
"pins": {
"6": "Btn;0",
"16": "SM16703P_DIN;0"
},
"command": "backlog startDriver SM16703P; SM16703P_Init 3 RGB; startDriver PixelAnim; SetFlag 10 1; addEventHandler OnClick 6 power toggle;",
"image": "https://obrazki.elektroda.pl/YOUR_IMAGE.jpg",
"wiki": "https://www.elektroda.com/rtvforum/topic_YOUR_TOPIC.html"
}This is ready to be copy-pasted into your OpenBEKEN import window. You can also find it Here.
Signing off. #
So that was all i managed to do in 1 evening after school/other stuff i am busy with. Its a sort of in-between project but i like how it turned out. COmpared to the pole light with seperate illuminated base, this was again a breath of fresh air. No weird hybrid 2 channel nonesense, just a very easy device to modify and free from the cloud.